A fixed-price review for AI-built apps
If you built your app with Claude Code, Cursor, Lovable or Replit and you are not sure, find out before you charge anyone. I review your app on staging and tell you what will break or leak first, how to reproduce it, and how to fix it. Fixed price. About a week.
01 / Who it is for
AI tools are good at making an app that works when you click through it. They are less reliable at the parts you cannot see by clicking: who is allowed to read which rows, what happens when a payment fails, where the keys ended up.
02 / What gets checked
You see the checklist before you pay. I work through all of it and report what I found in each area, including the ones that passed.
The one that hurts most if it is wrong.
Getting in, staying in, getting back in.
Stripe, in test mode.
Where they are and who can read them.
Uploads, downloads, storage buckets.
What happens on a bad day.
03 / What you receive
Document
Every finding has four parts: how serious it is, where it is, how to reproduce it on staging, and the fix I recommend. Ranked, so the top of the list is what to do first. Written so a developer or your AI tool can work from it directly.
Read the sample reportDocument
Plain English. Two lists: what to fix before you charge anyone, and what can wait. No jargon.
Call
I go through the report with you and answer questions. Bring your developer if you have one.
Follow-up
After you fix things, I check each finding again and mark it fixed or still open.
Clean-up
When the retest is done, you remove my access to the repo and staging, and I confirm it is gone.
04 / How it works
We talk for 30 minutes. I sign your NDA or send mine. We agree the fixed price in writing.
You give me read-only access to the repo, a staging URL and two test accounts. No production access.
I work through the checklist on staging and in the code. I confirm each finding by reproducing it.
You get the findings report and the one-page summary.
We go through it together for 30 minutes.
You fix. I retest once and send the updated report. Then access comes off.
Days are working days and count from the day access works. If something looks urgent on day 1, I tell you that day. I do not wait for the report.
05 / Price
$950
Fixed. Agreed in writing before I start. It does not go up if the review takes me longer than I planned.
Book a 30-minute callOptional second step
If you want me to fix the findings, I quote that separately after the report, per finding or as one price. You are free to take the report to anyone else. It is written so they can use it.
06 / What it is not
This is a practical review by someone who builds this kind of app. It is useful for what it is. It is not these things.
I do not issue one. If a customer or insurer asks for a penetration test report from a security firm, this will not satisfy them.
I am not an auditor or a lawyer. I will point out obvious problems with personal data. I cannot tell you that you comply.
I do not test how the app behaves under heavy traffic.
I never touch your live app or live customer data. Everything happens on staging with test accounts.
A review lowers the risk. It does not remove it. I report what I find in the six areas in the time agreed. No one can promise there is nothing else.
The review tells you what to fix. Fixing is a separate, optional step.
07 / Who does the review
I am Eugene. I do the review myself.
I build and ship production apps on Next.js, Supabase and Postgres, Stripe and the Claude API. I build with AI coding tools every day, so I know the kinds of mistakes they make and where those mistakes tend to sit.
I am a developer, not a security firm. That is why this is priced and described as a launch review, and why the section above exists.
08 / Questions
Tell me on the call. For a Next.js and Supabase app, a staging copy is usually a second Supabase project and a preview deployment. If you want me to set it up, I quote that separately before we start.
Ask anyway. The checklist is written for that stack because most AI-built apps I see use it. If yours is different, I will tell you before you pay whether I am the right person.
Read-only access to the repo, a staging URL, and two test accounts so I can check whether one can see the other’s data. For some checks I ask for read access to the staging Supabase project and Stripe in test mode. Nothing on production.
No, and no one honest will say yes. I work through a fixed checklist across six areas and report everything I find there. That covers the problems that most often hurt a new app in its first months. It is not a promise that nothing else exists.
Your choice. You can paste the fixes into your AI tool, give the report to a developer, or ask me for a quote. The retest is included whichever you pick.
30 days from the day you get the report.
We sign an NDA before I see anything. I work on staging with test data. I do not need real customer records and I ask you not to put any on staging. When we finish, you remove my access and I delete my local copy of the repo.
I invoice half before I start and half when the report is delivered. If you found me through a freelance platform, we use its fixed-price contract and you release payment when you have the report.
Yes. The sample is written for a made-up demo app, not a client's app. It shows the format and the level of detail you get. Read the sample report
09 / Next step
Book 30 minutes. Tell me what the app does, what it is built with and when you plan to launch. I will tell you whether this review fits and confirm the price. If it does not fit, I will say so.
Book a 30-minute call